Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-369h-pjr2-6wrh

Опубликовано: 25 авг. 2021
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

Uncontrolled recursion in trust-dns-proto

There's a stack overflow leading to a crash when Trust-DNS's parses a malicious DNS packet. Affected versions of this crate did not properly handle parsing of DNS message compression (RFC1035 section 4.1.4). The parser could be tricked into infinite loop when a compression offset pointed back to the same domain name to be parsed. This allows an attacker to craft a malicious DNS packet which when consumed with Trust-DNS could cause stack overflow and crash the affected software.

Пакеты

Наименование

trust-dns-proto

rust
Затронутые версииВерсия исправления

< 0.4.3

0.4.3

EPSS

Процентиль: 56%
0.00334
Низкий

7.5 High

CVSS3

Дефекты

CWE-674

Связанные уязвимости

CVSS3: 7.5
nvd
больше 6 лет назад

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.

EPSS

Процентиль: 56%
0.00334
Низкий

7.5 High

CVSS3

Дефекты

CWE-674